tcpdump stuff

Some scattered notes…

Filtering on host and port

I run into this error all the time:

# tcpdump -n host 10.0.0.1 port 123
tcpdump: can't parse filter expression: syntax error

You can use the host parameter and the port parameter individually. To combine them, you just need an and:

# tcpdump -n host 10.0.0.1 and port 123
dropped privs to tcpdump
tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), snapshot length 262144 bytes

Just counting packets

There has got to be a better way to do this, but I often forget about the timeout command:

# timeout 1 tcpdump -nn port 123 > /dev/null
dropped privs to tcpdump
tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), snapshot length 262144 bytes
26109 packets captured
26961 packets received by filter
0 packets dropped by kernel